May 28, 2005

Spying Chips Possible in the New IDs

Federal report warns of RFID misuse is the relatively benign-sounding headline. But look at two statements within the piece (I'll put them in bold in this quote to make that easier):

Radio frequency identification is becoming increasingly popular inside the U.S. government, but agencies have not seriously considered the privacy risks, federal auditors said.

In a report published Friday, the Government Accountability Office said that 13 of the largest federal agencies are already using RFID or plan to use it. But only one of 23 agencies polled by the GAO had identified any legal or privacy issues--even though three admitted RFID would let them track employee movements. ....

RFID is a catchall term for a broad array of technologies that includes everything from battery-powered "active" tags, such as those used in highway toll booths, to "passive" RFID tags that measure a fraction of a millimeter in each dimension, not counting the antenna in the device.Cities tempted by wireless

Agencies already are experimenting with passive RFID technology. Among the list of planned or actual uses: the Department of Defense for tracking shipments; the Department of Homeland Security for immigration and baggage tracking; the State Department for electronic passports; the Department of Veterans Affairs for "audible prescription reading."

In addition, under the Real ID Act, the Department of Homeland Security is responsible for designing a standardized ID card that could be RFID-outfitted.

Now, there's no reason for the government to want them in the pretty new national IDs they're trying to force us into, is there? Anyone want to offer some odds on whether our forthcoming slave-tags will be chipped?

I don't know why the Feds don't go all the way and unify driver's licenses with passports -- and create a new ID number to replace Social Security Numbers while building in a user-controlled PIN number for conducting transactions. Sssh! Don't give them any ideas -- even if Identity Theft is a monstrous problem these day.

Most people will need ID to function, though some will be able to avoid it by going underground altogether. Assuming you are still functioning in our US society -- paying bills, taxes, driving, and so on, the question becomes not evading identification altogether, but *managing* the flow of data that is collected about you.

Managing the flow, and even monkey-wrenching it by tactics such as using different nicknames and aliases is not illegal if not done with the intention to commit fraud. But ultimately, either the absence of a data trail or statistically significant patterns in the data will pique the interest of snoopers.

One solution is to randomize everything as much as possible. Avoid repetitive actions such as always withdrawing the same amount of money every Friday at the ATM. Then, every once in a while, an action that is at variance with your normal behavior will appear insignificant.

Manage yourself so that they don't manage you! And plan on becoming expert in Faraday Cages (perhaps a cottage industry in reading RFID tages will help solve the unemployment problem!)

I can understand the desire to plan for workarounds- I'm doing that myself. But I really think this article underscores the need to act to undo the damage that is being done before it comes to that.

I don't want to waste large chunks of my life trying to game the system while still living within the ever-changing bounds of the law, nor do I wish to have to make the choice to break it. I hope that as we start posting action opportunities- e.g. the HP action- that people will start writing those letters, making those phone calls, etc... to make clear that we are not at all pleased.